Firefox XPCOM 组件 - 调用方法 UnnamedClass 的权限被拒绝
Firefox XPCOM 组件可以跨多个页面读写页面内容吗？
设想： 一堆本地 HTML 和 javascript 文件。 “Main.html”文件打开一个窗口“pluginWindow”，并使用以下命令创建插件：
<代码> netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
var obj = Components.classes[cid].createInstance();
插件 = obj.QueryInterface(Components.interfaces.IPlugin);
插件.addObserver(handleEvent);
该插件有 3 个方法。
IPlugin.Read - 从插件读取数据IPlugin.Write - 将数据写入插件IPlugin.addObserver - 添加用于读取的回调处理程序。
然后“Main.html”调用pluginWindow 并尝试调用插件方法Write。
我收到错误：
调用方法 UnnamedClass.Write 的权限被拒绝
Can a firefox XPCOM component read and write page content across multiple pages?
Scenario:
A bunch of local HTML and javascript files. A "Main.html" file opens a window "pluginWindow", and creates a plugin using:
netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
var obj = Components.classes[cid].createInstance();
plugin = obj.QueryInterface(Components.interfaces.IPlugin);
plugin.addObserver(handleEvent);
The plugin that has 3 methods.
IPlugin.Read - Read data from pluginIPlugin.Write - Write data to the pluginIPlugin.addObserver - Add a callback handler for reading.
The "Main.html" then calls into the pluginWindow and tries to call the plugin method Write.
I receive an error:
Permission denied to call method UnnamedClass.Write
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
首先，你的 C++ 代码真的是插件还是XPCOM 组件，可能作为 扩展？ 看来是后者了
如果是这样，则无法从不受信任的 JS 代码（任何网页或本地 HTML 文件）使用它。 它完全可以通过特权代码使用，其中最常见的类型是扩展代码。
您在使用
enablePrivilege('UniversalXPConnect')调用创建组件时解决了此问题。 这并不是真正推荐的，除非这不会分发给用户（因为此调用会弹出一个令人困惑的框，并且如果您设置首选项始终允许 file:// 脚本使用 XPCOM，则可能是一个安全问题，因为并非所有本地脚本页面是可信的 - 想想保存的网页）。您的
Write调用因同样的原因而失败 - file:// 页面不被信任使用 XPCOM 组件。 如果您在与 Write 调用本身相同的函数中添加另一个enablePrivilege调用，您可能可以让它工作。根据具体情况，可能会有更好的解决方案。
如果您的文件必须被视为受信任，您可能需要将它们打包为扩展名并通过 chrome:// URL 访问它们。 这使这些页面中的代码有权调用任何 XPCOM 组件，包括您的组件。
如果组件的方法可以从任何页面安全使用，或者环境受到控制并且浏览器中没有加载不受信任的页面，则可以使组件可访问内容（在 mozilla 代码 作为示例，也适用于
nsISecurityCheckedComponent）。哦，当您在这里没有得到好的答案时，您一定应该尝试 mozilla 新闻组/邮件列表。
[编辑回复评论] 考虑将需要调用组件的代码放在 chrome:// 脚本中。 或者，您应该能够使用类似 this （请注意，它的作用与您所需的相反 - 剥夺 chrome 权限）。
First, is your C++ code really a plugin or an XPCOM component, possibly installed as part of an extension? Sounds like it's the later.
If so, it's not usable from untrusted JS code - any web page or a local HTML file. It's fully usable from privileged code, the most common type of which is the extension code.
You're working around this problem when creating the component using the
enablePrivilege('UniversalXPConnect')call. This is not really recommended, unless this will not be distributed to users (since this call pops a confusing box and if you set a preference to always allow file:// scripts use XPCOM, it may be a security problem, since not all local pages are trusted - think saved web pages).Your
Writecall fails for the same reason - file:// pages are not trusted to use XPCOM components. You probably can get it to work if you add anotherenablePrivilegecall in the same function as the Write call itself.Depending on the situation, there may be a better solution.
If your files must be treated as trusted, you may want to package them as an extension and access them via a chrome:// URL. This gives the code in those pages permissions to call any XPCOM component, including yours.
If the component's methods are safe to use from any page or if the environment is controlled and no untrusted pages are loaded in the browser, you could make your component accessible to content (search for nsSidebar in mozilla code for an example and also for
nsISecurityCheckedComponent).Oh, and when you don't get good answers here, you should definitely try the mozilla newsgroups/mailing lists.
[edit in reply to a comment] Consider putting the code that needs to call the component in a chrome:// script. Alternatively, you should be able to "bless" your pages with the chrome privileges using code like this (note that it does the opposite of what you need - stripping away the chrome privileges).
Main.html 和其他窗口是否以 chrome 权限运行？
如果您“正常”访问 Main.html，只需将其放在 Firefox 的地址栏上，那么它的功能就会受到限制（否则，任意网页都可以执行完全相同的操作）。
如果您要创建 Firefox 插件，请将代码放在 XUL 覆盖层中。
如果您确实想让任何网页执行您的插件所做的任何事情，您可以建立某种机制，通过该机制页面可以要求插件使用其 chrome 权限执行操作，然后将结果发送到页面。
如果你没有制作 Firefox 扩展...那么我恐怕我误解了一些东西，你能解释一下吗？
Does Main.html and that other window run with chrome privileges?
If you access Main.html "normally", just putting it on the location bar of Firefox, then it will have restrictions to what it can do (Otherwise, an arbitrary web page could do exactly the same).
If you are creating a firefox plugin, place your code in a XUL overlay.
If you really want to allow any web page to do whatever it is your plugin does, you can establish some mechanism through wich the page can ask the plugin to do the operation with its chrome privileges and send the result to the page afterwards.
If you are NOT making a firefox extension...then I am afraid I misunderstood something, could you explain it more?